MALICIOUS — e0b5d38f7496f3c22aa723815405af4b3fb7fe8271bc5b0ef2d8b5e34e880160

MALICIOUS — e0b5d38f7496f3c22aa723815405af4b3fb7fe8271bc5b0ef2d8b5e34e880160 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e0b5d38f7496f3c22aa723815405af4b3fb7fe8271bc5b0ef2d8b5e34e880160
SHA-1: 70c88e7f43824af14c9f939f921e0b279003147d
MD5: dc8e239f5aae64363b964d0a90836fbe
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFTgm6YSdnzG6a+DFHGsq9XfmbyGc:O+K88uPCHxXVS1UWFHhkXsyGc
TLSH: T1D75A23869A294B49E3F2D490281927AD8142E8D5977C0CCE434FF12EB7CB577B432297
Submitted as: e0b5d38f7496f3c22aa723815405af4b3fb7fe8271bc5b0ef2d8b5e34e880160
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\4ADF.tmp - e5fcc0c8d49f9d89682cdcdf9ba644dff31a7e8ae397ebb8b1f3fc9fe8d88423
0415425b5b2d62f252e8c94982064abaa581c34b1c372057593a5dfe3c3fa488 - 0415425b5b2d62f252e8c94982064abaa581c34b1c372057593a5dfe3c3fa488

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787863594&P2=404&P3=2&P4=fXKqnLqXavcd5ERXgFhayqaBk7gZ%2fPIvGYKb3h2ERmv%2bKYCC0rjlX9IEpjoYvusmiy6CcTIglqW5Zxnumpg2lw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787863607&P2=404&P3=2&P4=hWubBtj3w1UmbP3z0mbfAVBbpTYiruxNaLsT1U8ZPkqhc2PipX8vI61PEYT%2fADS8nPVsAmrPnr5uUMK%2fcLt1eA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.73.26
4.230.171.124
20.247.184.197
48.211.4.16
20.42.179.192
74.178.76.128
135.232.92.97
51.132.193.105
52.123.129.14
20.76.201.171
52.123.128.14
20.184.175.20
135.234.160.244
135.232.92.34
203.26.79.13
52.148.114.188
52.110.12.28
4.150.223.109
52.178.17.3
52.110.12.32
40.84.85.40
72.154.7.107
52.110.12.16
52.110.12.33

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report